Windows sessions

A session is a container for a user's processes and data identity.

The special session 0 is used for system processes and services.

This session (or services?) cannot display a user interface directly but can call WTSSendMessageA to open a message box in another session.

A session runs its own win32k instances under csrss.exe.

The first user to log on is connected to session 1, the next to session 2 and so on.

On the command line (cmd.exe, PowerShell), a session can be terminated with logoff.exe.

Relation to terminals

A terminal is the set of in/out devices attached to a computer, typically keyboard, mouse and monitor etc, including their configuration.

A terminal is most of the time attached to a session, in fact, this is the terminal's purpose. (A terminal is not attached if it is being destroyed or in the process of being attached).

Common types of terminals

The two common terminal types are

Console terminals	Connected to a console host. Only one active console terminal on a given machine - and, with a few exceptions, always active.
Remote terminals	The input and output is transferred from/to devices that are not present on the local systems. Remote terminals are created protocol providers that integrate with the Remote Desktop SErvices interface (RDP, Citrix, VMWare …)

There are also other terminal types, but these are rare.

TODO

The session id in the key name HKEY_CURRENT_USER\Volatile Environment\n and the value of SESSIONNAME within that key.

Windows sessions

Relation to terminals

Common types of terminals

TODO

See also